Juan José Mata 69827dada8 Fix transaction search account scope bypass (#1460) ...

Ensure accessible_account_ids filtering is applied whenever account scope is provided, including empty arrays, so users with no shared accounts cannot see family-wide transactions.

Also make totals robust when scoped queries return no rows and add regression tests for both visibility and totals behavior with empty accessible account lists.

2026-04-13 21:23:59 +02:00

22 KiB

Raw Blame History

View Raw